Analysis

  • max time kernel
    188s
  • max time network
    195s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 22:23

General

  • Target

    8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe

  • Size

    378KB

  • MD5

    f0c96682156bf5e3d203bd475a7238a8

  • SHA1

    df6a26935cc0e14ba021760fb311fb4d8415196c

  • SHA256

    8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a

  • SHA512

    16731b091fe8082f10b30e1ec56efdc1b150f1117547e51f81cd3b8437bac56213e05c4c0ebb259a00a3d067dfa45db4dd42e404bbd06f8bacd74099d8e92203

  • SSDEEP

    6144:mPR/t8jWHOJPhhHU1PgvVqgVIO9mZuITtOMDfeKQK38KyarXXW0aUSSdl:c8jIshhHYPuVGTlDGKDyGXW0aZk

Score
10/10

Malware Config

Signatures

  • Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
    "C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1344
    • C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
      "C:\Users\Admin\AppData\Local\Temp\8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe"
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:720

Network

  • flag-unknown
    DNS
    176.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.122.125.40.in-addr.arpa
    IN PTR
    Response
  • 104.208.16.90:443
    322 B
    7
  • 93.184.220.29:80
    322 B
    7
  • 67.26.111.254:80
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
  • 67.26.111.254:80
    322 B
    7
  • 91.236.116.124:9019
    8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
    260 B
    5
  • 91.236.116.124:9019
    8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
    260 B
    5
  • 91.236.116.124:9019
    8e621f4dc61fe7d9f62fef11d34d7d0287bda2b974b401bc7882a1ce1de7688a.exe
    104 B
    2
  • 8.8.8.8:53
    176.122.125.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    176.122.125.40.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/720-135-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/720-137-0x00000000751A0000-0x0000000075751000-memory.dmp

    Filesize

    5.7MB

  • memory/720-138-0x00000000751A0000-0x0000000075751000-memory.dmp

    Filesize

    5.7MB

  • memory/1344-132-0x00000000751A0000-0x0000000075751000-memory.dmp

    Filesize

    5.7MB

  • memory/1344-133-0x00000000751A0000-0x0000000075751000-memory.dmp

    Filesize

    5.7MB

  • memory/1344-136-0x00000000751A0000-0x0000000075751000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.